CVE-2024-24764 October Open Redirect for Administrator Accounts

October is a self-hosted CMS platform based on the Laravel PHP Framework. This issue affects authenticated administrators who may be redirected to an untrusted URL using the PageFinder schema. The resolver for the page finder link schema october:// allowed external links, therefore allowing an op...

CVE-2024-24764

CVE-2024-24764 affects October CMS (Laravel-based). Authentication is required for admins to trigger an open redirect via the PageFinder schema (october://), allowing redirection to external URLs outside the active host. The issue is resolved by upgrading to version 3.5.15, which patches the vuln...

October Security breach

October is a content management system CMS and web platform from October Open Source. A security vulnerability exists in October prior to version 3.5.15, which stems from the X-October-Request-Handler header that does not clean up AJAX handler names and allows unescaped HTML to be reflected back...

October CMS Security Breach

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A security vulnerability exists in October CMS prior to version 3.5.15, which stems from the possibility that the PageFinder framework may redirect to untrusted URLs...

October CMS Cross-site Scripting vulnerability

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

GHSA-GCGJ-QH8P-57HM October CMS Cross-site Scripting vulnerability

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

CVE-2023-25365

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

Cross site scripting

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

CVE-2023-25365

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

CVE-2023-25365

October CMS 3.2.0 is affected by a Cross Site Scripting (XSS) vulnerability that can permit a local attacker to execute arbitrary code via the .mp3 file type. The issue appears to reside in file handling/upload logic, enabling code execution through specially crafted MP3 uploads. Public reference...

October CMS Code Issues Vulnerabilities

October CMS is an open source content management system CMS based on PHP and the Laravel web application framework. A code issue vulnerability exists in October CMS version v.3.2.0, which stems from the presence of a cross-site scripting vulnerability that allows a local attacker to execute...

CVE-2023-25365

Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3...

PT-2024-12056 · Unknown · October Cms

Name of the Vulnerable Software and Affected Versions: October CMS version 3.2.0 Description: A Cross Site Scripting issue allows a local attacker to execute arbitrary code via the file type .mp3. Recommendations: For October CMS version 3.2.0, update to a version that fixes this issue to prevent...

CVE-2023-44382

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

CVE-2023-44381

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

Code injection

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

Design/Logic Flaw

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

CVE-2023-44381 October CMS safe mode bypass using Page template injection

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...

CVE-2023-44381

CVE-2023-44381 affects October CMS. Affected component: template rendering in the CMS where an authenticated backend user with editor.cms_pages, editor.cms_layouts, or editor.cms_partials permissions can craft a request to inject PHP code into a CMS template due to cms.safe_mode being enabled. Th...

CVE-2023-44381 October CMS safe mode bypass using Page template injection

October is a Content Management System CMS and web platform to assist with development workflow. An authenticated backend user with the editor.cmspages, editor.cmslayouts, or editor.cmspartials permissions who would normally not be permitted to provide PHP code to be executed by the CMS due to...